When Automation Fails, Qantas Pilot Employs Military Training

When the autopilot suddenly switched itself off aboard Qantas Flight 72 on Oct. 7, 2008, pilot Kevin Sullivan was puzzled. The Airbus A330, on a flight from Singapore to Perth, was approaching the coast of northwest Australia near the town of Exmouth. The weather was clear and the aircraft seemed to be operating normally.

The mystery was compounded by the jarring sound of the stall warning. Odd, Sullivan thought. He was in cruise configuration at 37,000 feet on a clear day. Whatever the A330 was doing, it wasn’t stalling. A moment later, Sullivan found himself staring straight ahead at the Indian Ocean and his world changed forever. The aircraft’s complex automation had malfunctioned and the only thing that stood between Qantas Flight 72 and the deep blue sea was Sullivan’s extensive experience.

“It was an aggressive pitch-down—violent, without warning,” Sullivan told AIN. “I had to brace myself on the glareshield. There are no warnings that say the airplane can maneuver violently on its own. But it did.”

Sullivan hauled back on the sidestick, pulling it almost to the stop. Nothing happened. So he reverted to his training as a high-time U.S. Navy fighter pilot. He neutralized the controls.

“I was looking at the Indian Ocean filling my windscreen. My control input was not effective. I was basically a passenger at that point, not a good place to be if you’re pilot-in-command. So I let go of the stick,” he said.

At the moment of the pitch-down, the Airbus had been holding a nose-high attitude of +2 degrees. Two seconds later, the nose had dropped -8.4 degrees. The wings sliced through the air with an audible rushing sound as the aircraft went from +1g to -.8g.

Violent Pitching

In the back of the airplane, dozens of passengers who were standing or seated without wearing their seatbelts were thrown up to and in some cases, through the carry-on bins and ceiling panels.

“What the hell just happened?” asked Sullivan’s second officer, who was flying right seat.

“That’s when the startle hit,” said Sullivan, a veteran pilot who had logged more than 17,000 flight hours. He didn’t know what happened, but he figured the A330’s computers were reacting to something. He noted a fault in one of the flight control primary computers (FCPC). Sullivan reset the FCPC, known as PRIM3.

Again, without warning, the aircraft violently pitched down. Again, Sullivan was unable to stop it by pulling back on the stick. Again, he let the stick go to neutralize the controls.

“I’m in trouble,” Sullivan remembered thinking. “I don’t know what’s happening and the airplane isn’t communicating with me. I’m getting master caution chimes. But every time they sounded, a message would flash on the computer monitor and quickly disappear. We couldn’t discern what was wrong.”

Unwilling to trust the A330’s automation anymore, Sullivan left the autopilot off. He disconnected the auto-trim and autothrottles. He declared a Pan (indicating an urgent situation that was not immediately life-threatening_ and, moments later, a Mayday.

The closest airport was a sleepy joint military/civilian field called RAAF Base Learmonth, approximately 37 kilometers south of Exmouth. Given the number and extent of injuries on board, Sullivan opted to land there rather than continue another hour-and-a-half to Perth. Exmouth had a small hospital with just two ambulances. ATC told Flight 72 the hospital would need a half-hour to prepare. That was fine with Sullivan. He needed the time to figure out how he would land his crippled A330.

The stall warning continued to sound—as did the master caution and overspeed warnings. The cacophony was terribly distracting, Sullivan remembered. Ignoring them required a special effort, he added, since company policy called for a mandatory response to some of the warnings. Unable to ascertain the extent to which his aircraft was malfunctioning, Sullivan again reverted to his military training.

“In the Navy, we used a ‘high-energy’ approach in single-engine jets when we suspected airframe or engine damage due to combat,” Sullivan said. From 37,000 feet, he would pull the throttles back to idle, then approach the field in a high-angle, high-energy configuration.

Even then, the aircraft refused to cooperate, Sullivan recalled. His first officer had returned to the flight deck by this time, his nose broken in the pitch downs. The first officer tried to enter a non-precision approach to Learmonth. The computer refused to accept it.

Manual Approach and Landing

Flight 72 circled Learmonth, descending until it was abeam the field at 11,000 feet. That’s when Sullivan began his visual approach. He recalls his thoughts during the experience.

Thrust to idle.

Nose down.

We need to lose 8,000 feet to arrive at 3,000 feet for a ten-mile final.

Sullivan turned to base at 5,000 feet, constantly worried that the aircraft would again pitch down. Using the radio, the Second Officer activated the PAPI as Flight 72 turned to final.

“Speed,” warned the first officer.

“Acknowledged,” replied Sullivan. He wanted to be fast as he aimed just shy of the runway threshold.

Gear down. That worked. Good.

Flaps at configuration 2.

Trim manually.

Throttles still idle.

1,500 feet, still descending at 3 degrees, verified by the PAPI.

Threshold.

Touchdown.

From the back of the air plane, the passengers gave Sullivan and his flight crew a rousing cheer. The stall, master caution and overspeed warnings continued to sound even as Flight 72 taxied to the small terminal at RAAF Learmonth.

As medical crews rushed aboard to help the injured passengers and crew, Sullivan walked aft through the passenger cabin. He was “heartbroken” at the devastation. Images of the bruised and bloodied passengers and crew seared themselves into his brain.

Sullivan remained in command of both passengers and airplane until all of the injured had been cared for. He then shepherded the remaining passengers into the terminal. Hours later, two Qantas aircraft landed at Learmonth to fly the passengers and crew back to Perth. Only after they arrived at their original destination, said Sullivan, did he allow himself to relax.

Post-flight analysis by the Australian Transportation Safety Bureau (ATSB) showed one of the A330's three air data inertial reference units (ADIRUs) was sending faulty information to the FCPCs in spikes every 1.2 seconds. The flight control computers misinterpreted that data, causing them to react as though the aircraft was in a nose-high stall. That led to the pitch downs.

Sullivan and his crew were commended by the ATSB for their professionalism

In all, 110 passengers and eight crewmembers were injured in the pitch-down incidents—some severely.

And you can add one more casualty to the list.

Plagued by post-traumatic stress disorder and the memory of those who were so badly hurt, Sullivan attempted several times to resume his career as a pilot. But after seven torturous years, he gave up in 2015, convinced that his future lies somewhere other than in the cockpit.